Firewalls filter traffic flowing between two or more networks. Typically these devices are routers connecting a public (e.g., untrusted) network and one or more private (e.g., trusted) networks. These types of firewalls are called an edge firewalls. As more personal computers connect to the public networks such as the Internet, host firewalls (e.g., personal firewalls local to the client computer system) became a useful component of a host protection strategy. Host firewalls help reduce the available attack surface against malware and malicious entities on the Internet by blocking unsolicited traffic directed toward computers. In addition, host firewalls give an administrator a way to enforce policy on the system by creating an allow-list (or do-not-allow-list) of applications that can be allowed (or blocked) from listening on (or connecting to) the network.
As mobile computing becomes widespread, users attach their computers to untrusted public networks (e.g., via public WiFi) in order to get access to the Internet, which poses a security risk for the users. In most cases, firewall exceptions (e.g., allow and do-not-allow policies) for services and applications that are enabled on the user's home networks (e.g., file sharing) also remain enabled when these users connect to unprotected public networks (such as a coffee shop or the airport WiFi). Conventional firewall systems are not “smart” enough to understand the type of network the computer is connected to and disable the exceptions that are not needed on unprotected public networks.
Once a user has created a list of firewall “exceptions” that are allowed to listen for incoming connections, a conventional host firewall makes sure that no other unsolicited traffic will get inside the computer. Most conventional host firewalls enforce allow/block rules in a fairly static manner, for example, once an application is allowed/blocked it continues to be allowed/blocked regardless of the environment a computer could be operating under.